When an API request using the ?key= query-string form throws, the Diagnostic Center records the full request URL including the key (e.g. Unhandled exception processing http://host:8622/api/json/?key=...). The key is then readable by anyone with Diagnostic Center access or via LogMessages_GetMessages. Suggest redacting key when logging request URLs. (Workaround on our side: send the key as the X-ApiKey header instead.)

A bare GET /api/releases (valid API key, no filter) returns 500:

System.NullReferenceException: Object reference not set to an instance of an object.
at ...SimpleHandlers.Api.Releases.ReleaseJsonModel.FromRequest(AhHttpRequest request)
at ...SimpleHandlers.Api.Releases.ReleaseApiHandler.ProcessRequestAsync(...)
Scoped calls (filter in the JSON body) work. Expected: all releases, or a 400.

The conversion could not be completed because the supplied DateTime did not have the Kind
property set correctly. … (Parameter 'sourceTimeZone')

at System.TimeZoneInfo.ConvertTime(DateTime, TimeZoneInfo, TimeZoneInfo, TimeZoneInfoOptions, CachedData) at System.TimeZoneInfo.ConvertTimeFromUtc(DateTime dateTime, TimeZoneInfo destinationTimeZone) at Inedo.BuildMaster.Web.WUtil.FormatUtcDateTime(Nullable`1 dateTime, DateTimeFormat format) at ...ApplicationAllSettingsPage.g__getCiRow|1(SecureResources, SecureResource, CIProject, Boolean) at ...ApplicationAllSettingsPage.GetConnectionsTableAsync() at ...ApplicationAllSettingsPage.CreateChildControlsAsync()

The throw is in the CI-connection row renderer: a stored date reaches ConvertTimeFromUtc with Kind=Local, which throws unconditionally, so no user or instance time-zone setting can work around it. This page appears to be the only UI route that reads/edits an application's CI project connection, so the defect blocks managing that connection entirely.